As of November 2026, there has been significant development involving a new zero-day proof-of-concept sandbox escape called worse_query by forcequitOS, released on November 8. It is now the direct successor to the bad_query exploit.
As stated by forcequitOS, this is not relevant to a jailbreak and never will be.
iOS isolates applications inside of their own individual containers. This means an application can access files in its own directory, but it cannot access anything outside of it unless permitted to do so, such as with shared app containers. iOS system files.
worse_query bypasses these restrictions by exploiting iOS's container management, allowing an application using this exploit to access directories that are normally inaccessible.
These directories include:
/var/mobile/Containers/Data/Application/
/var/mobile/Containers/Shared/AppGroup/
/var/mobile/Containers/Data/InternalDaemon/
/var/mobile/Containers/Data/PluginKitPlugin/
And on iOS 27:
/var/containers/Data/System/
/var/containers/Shared/SystemGroup/
Note that being able to reach a directory does not always mean the files in it can be read or modified.
The original bad_query exploit was much more limited and only supported iOS 26.0 through 26.6.1, and iOS 27 Beta 4.
worse_query, as of now, supports iOS 26.0 through 27.2, along with 27.3 Beta 1.
worse_query also has a new requirement, that being an App Group entitlement.
The exploit released yesterday, and within no-time, community tools started showing up; The most notable being Erosion, a tool that allows system customization, custom wallpapers, and more.
There are also various new file browsers being made, such as WQfiles, which allows you to browse other application's data, back up and restore their data, as well as edit plist, text, and binary files. It also a cache-cleaning utility.
As stated by forcequitOS, this is not relevant to a jailbreak and never will be.
iOS isolates applications inside of their own individual containers. This means an application can access files in its own directory, but it cannot access anything outside of it unless permitted to do so, such as with shared app containers. iOS system files.
worse_query bypasses these restrictions by exploiting iOS's container management, allowing an application using this exploit to access directories that are normally inaccessible.
These directories include:
/var/mobile/Containers/Data/Application/
/var/mobile/Containers/Shared/AppGroup/
/var/mobile/Containers/Data/InternalDaemon/
/var/mobile/Containers/Data/PluginKitPlugin/
And on iOS 27:
/var/containers/Data/System/
/var/containers/Shared/SystemGroup/
Note that being able to reach a directory does not always mean the files in it can be read or modified.
The original bad_query exploit was much more limited and only supported iOS 26.0 through 26.6.1, and iOS 27 Beta 4.
worse_query, as of now, supports iOS 26.0 through 27.2, along with 27.3 Beta 1.
worse_query also has a new requirement, that being an App Group entitlement.
The exploit released yesterday, and within no-time, community tools started showing up; The most notable being Erosion, a tool that allows system customization, custom wallpapers, and more.
There are also various new file browsers being made, such as WQfiles, which allows you to browse other application's data, back up and restore their data, as well as edit plist, text, and binary files. It also a cache-cleaning utility.